Vehicle computer system

ABSTRACT

A vehicle computer arrangement, particularly for a motor vehicle, a train, an airplane or a ship, which is provided with at least two computers ( 10, 20 ) and at least one data bus ( 60 ) via which the at least two computers ( 10, 20 ) are interconnected, and in which at least one monitoring circuit ( 40 ) is arranged between a first computer ( 10 ) and a second computer ( 20 ) of the at least two computers, the monitoring circuit checking whether a data exchange between the first and the second computer is permitted for data processed or to be processed in the first or the second computer, and blocking the data exchange in the event that it is not permitted for the monitored data.

FIELD OF THE INVENTION

The present invention is based on a vehicle computer arrangement,particularly for a motor vehicle, a train, an airplane or ship, havingat least two computers and at least one data bus, via which the at leasttwo computers are interconnected.

BACKGROUND INFORMATION

Modern vehicles, particularly motor vehicles, are generally equippedwith a plurality of electronic systems, i.e. an audio-signal system anda safety system, functioning independently of one another. Theaudio-signal system generally includes an AM/FM broadcast receiver, acompact cassette (CC) or a compact disk (CD) player, a tone controller,for example, in the form of an equalizer, an amplifier and loudspeakers.The broadcast receiver and the CC or CD player, and often the equalizeras well, are accommodated together in a common housing provided forinstallation in the dashboard of a motor vehicle, the housing beingstandardized with respect to its size, thus ensuring that the audiosystem can be installed in at least a majority of motor-vehicledashboards.

The safety system mentioned generally functions completely independentlyof the audio system. The safety system is usually made up of a pluralityof sensors distributed over the motor vehicle, and a central,application-specific, integrated circuit (ASIC) for recording the sensorsignals and possibly for triggering safety-relevant functions. Inaddition, the safety system controls actuators, for example, for openingand closing the doors or windows, and, for instance, an alarm system.

In addition, the newest motor vehicles are also provided with adiagnostic system which monitors the functioning of the motor-vehicleengine, the power transfer, the fuel system and possibly furthercomponents. The diagnostic system can be connected to an externalcomputer, so that the recorded diagnostic information can be read outfrom the computer of the diagnostic system and evaluated, e.g. forrepairing a vehicle. Moreover, the diagnostic system also includesdisplay devices, integrated into the dashboard, which inform themotor-vehicle driver about the operating state of the vehicle.

In the same way, various modern motor vehicles are provided withnavigation systems which, from sensors located on the vehicle, e.g. acompass, an odometer, as well as the output signals of a GPS (GlobalPositioning System) receiver, determine the current vehicle position,and by comparing the current vehicle position to an electronicallystored map, with the aid of a start position and destination positionspecified by the motor-vehicle driver, generate navigation informationfor guiding the motor-vehicle driver.

In addition, motor vehicles are often also equipped with communicationsystems, e.g. in the form of mobile telephones. Particularlywell-developed systems are voice-controlled, and thus allow themotor-vehicle driver to initiate or receive telephone calls whiletraveling, without at the same time having to remove a hand from thesteering wheel or being otherwise distracted from the traffic situation.

Each of the described systems is provided with its own special processoror ASIC for processing the special software necessary for the devices.If, at this point, a motor-vehicle owner would like to retrofit one ofthe described systems in his motor vehicle, he/she is forced to acquireand install a complete system, including the special processor necessaryfor the system, in the vehicle.

A computer system for a vehicle, particularly a motor vehicle, is knownfrom WO 97/19833, in which the various above-described, independentcomponents are integrated, and which is provided with an open hardwarearchitecture and a shared operating system for the various components,thus making it possible to retrofit one of the above-indicated orfurther components by connection to the existing computer arrangement.

The German Patent DE 35 43 996 C2 describes a multi-computer arrangementfor a vehicle, particularly a motor vehicle, in which the variouscomputers are interconnected for the purpose of exchanging information.Different, suitably characterized, permanently stored data records arestored in write-read memories allocated to the various computers topermit, for example, the user to subsequently adapt the program flows tobe processed in the computers. Using a freely programmable memory, it ispossible to access the stored data records at the beginning of thecomputer operation by inputting corresponding identifiers, and thus toadapt the program flows for the computers.

SUMMARY OF THE INVENTION

The vehicle computer arrangement of the present invention has theadvantage that the demands for system stability and safety are met,accompanied at the same time by an increase in flexibility whenequipping or retrofitting a vehicle fitted with the vehicle computerarrangement with various further applications. To that end, the vehiclecomputer arrangement is provided with a monitoring circuit which ensuresthat access to safety-critical operating-program components orcomponents of the computer arrangement is enabled only for an authorizedgroup of people, e.g. the motor-vehicle manufacturer. Thus, the safetydemands of the motor-vehicle manufacturers, who, in view of threateningwarranty claims, have an interest in the integrity of the operatingprograms specified by them, are fulfilled. An uncontrolled access tosensitive areas of the vehicle computer arrangement or of the operatingprograms is therefore effectively ruled out.

Along the lines of a cost reduction, it is particularly advantageous ifat least one of the computers of the vehicle computer arrangement is astandard personal computer, and a standard operating system is used forthe communication between the computer(s) and further componentsconnected to the computers. Underlying this is the consideration thatstandard personal computers are produced in much greater quantity than,for example, special computers tailored to specific applications such asthose of a vehicle navigation system or of an engine management. Sincethe production costs are far less crucial for standard personalcomputers because of their much larger production numbers compared tospecial computers, a considerably lower production cost results forvehicle computer arrangements based on standard personal computers. Thesituation is the same with the operating systems used for thecommunication of the computers among themselves or with the furtherconnected components; falling back on standard operating systems makesit possible to dispense with a time-consuming and therefore costly newdevelopment of special operating systems.

In addition, the use of standard operating systems for the computers ofthe vehicle computer arrangement has the advantage that a widespread andgenerally accepted standard for data exchange is available for furthercomponents that are subsequently connectible to the vehicle computerarrangement. Thus, the need to adapt further connectible components tovarious operating systems is eliminated, as well as the associatedadditional costs.

BRIEF DESCRIPTION OF THE DRAWING

The FIGURE shows a vehicle computer arrangement according to the presentinvention having computers that are interconnected via data buses,further components being connected to the data buses.

DETAILED DESCRIPTION

FIG. 1 shows by way of example the vehicle computer arrangement, that isto say, a segment of a vehicle computer arrangement according to thepresent invention.

The vehicle computer arrangement of the invention according to thepresent exemplary embodiment includes three computers 10, 20, 30, whichare provided for processing different types of information; namely, afirst computer 10 for processing vehicle-specific information, a secondcomputer 20 for processing information of multimedia applications, and athird computer 30 for processing information of the so-called bodyelectronics, thus, for example, of the central locking system, thesliding sunroof control, and an electrical seat- and mirror adjustment.

The three computers 10, 20, 30 of the present exemplary embodiment areinterconnected via data and/or control buses 60, 70, 80, a first bus 60connecting first and second computers 10, 20, a second bus 70 connectingfirst and third computers 10, 30, and a third bus 80 connecting secondand third computers 20, 30 to one another. In addition, a fourth bus 85is connected to the third computer.

The described buses are not only used to interconnect the at least twocomputers; rather, further components are connected to buses 60, 70, 80,85 such as, for example, an engine management 12 connected to second bus70, a broadcast-receiver component 22 connected to third bus 80 and, forinstance, an electrical seat- and mirror adjustment 33 connected tofourth bus 85.

In addition, the vehicle computer arrangement shown in the FIGURE isprovided with an interface 90 which enables the vehicle computerarrangement to communicate with external components such as, forexample, a diagnostic unit located in a motor-vehicle service stationand connected to the vehicle computer arrangement.

Finally, the vehicle computer arrangement shown in the present case isprovided with a first and a second monitoring circuit 40 and 50, firstmonitoring circuit 40 being arranged between first computer 10 andsecond computer 20, and second monitoring circuit 50 being arrangedbetween first computer 10 and third computer 30. First monitoringcircuit 40 has the task of checking whether a data exchange between thefirst and the second computer is permitted for data processed or to beprocessed in the first or the second computer, and to block the dataexchange in the event that it is not permitted for the monitored data.Analogously, second monitoring circuit 50, arranged between the firstand the third computer, has the task of checking and, if applicable,preventing the data exchange between first and third computers 10, 30.

Further components 12 through 17 of a first group of further componentsconnected to first bus 70 are, in detail:

an engine management 12 which in known manner, for example, as afunction of the engine temperature, the engine speed, the load state ofthe engine and the air quantity that is necessary for the fuelcombustion and is determined by an air-mass flow sensor, and optionallyas a function of an output signal from a λ probe determining theexhaust-gas composition, meters to the engine the ideal fuel quantitycalculated with reference to a characteristics field stored in firstcomputer 10; and which in known manner, for example, as a function ofthe load state of the engine and as a function of the output signalsfrom a knock sensor, with the aid of further characteristics fieldsstored in computer 10, sets the ignition point that is ideal for thecombustion process in the case of an Otto spark ignition engine;

a transmission-shift control 13 which, in the case of an automatictransmission, establishes the ideal switching points as a function ofthe load and speed data of the motor-vehicle engine; which, in the caseof individual, slipping driven wheels, partially or completely blocksthe differential along the lines of a traction control system (TCS); andwhich, for example, adapts to the driving habits of the motor-vehicledriver along the lines of an intelligent transmission-shift control tothe effect that, for instance, if the motor-vehicle driver has apredominately sporty driving style, the switching points are shiftedtoward higher engine speeds, while if the driving style of themotor-vehicle driver is more conservative, the switching points areshifted toward lower speeds;

sensors 14, allocated to engine management 12 and transmission-shiftcontrol 13, such as a water-temperature and/or oil-temperature sensor, aload sensor for ascertaining the load state of the motor-vehicle engine,a knock sensor for determining whether a knocking combustion may bepresent, an air-mass flow sensor for determining the air quantitynecessary for the combustion taking place in the engine, aλ probe fordetermining the exhaust-gas composition, etc.;

a control 15 for an anti-lock braking system (ABS) which prevents thebraked wheels from locking when the motor vehicle is braked;

a seat-belt-tightener control or airbag control 16 which, in the eventof an accident, increases the effectiveness of the seat belt, and, inaddition, deploys an airbag to protect the driver;

a further group of sensors 17 including, for example, wheel sensors fordetermining the stoppage of a wheel of the motor vehicle in response toa braking process, crash sensors for deploying the airbag in the eventof an accident, etc.

First computer 10, to which described further components 12 through 17are connected via bus 70, in addition to providing characteristicsfields for, e.g., the fuel-quantity metering and for adjusting theignition point and possibly for ascertaining the optimum values for thefuel rate and for adjusting the ignition point, is also used forhandling the communication of the further components among each other.Thus, first computer 10 also regulates, inter alia, the transfer ofdata, necessary for determining the ignition point and the mixturepreparation, from sensors 14 to engine management 12, that is to say, itreads the data from sensors 14, calculates therefrom, with the aid ofthe stored characteristics fields, the optimal values for the ignitionpoint and the mixture metering, and makes them available to enginemanagement 12. In the same way, first computer 10 also controls, forexample, the communication of the ABS control unit with wheel sensors17.

Components 22 through 28 connected to the second computer are, indetail:

a broadcast-receiver component 22 for the reception of radio programsbroadcast via broadcast transmitting frequencies, and optionally ofadditional information broadcast via the broadcast transmittingfrequencies;

a compact-disk player 24 in the form of a so-called CD changer, by whichone compact disk is selected for playback from a plurality of compactdisks inserted in the CD changer, and which makes reproducible audiosignals available as output signal;

a transceiver 26 in the form of a GSM mobile telephone; and

a navigation unit 28 which, as a function of a predefined starting anddestination location, data of a digitally stored map, and informationabout the current position of the motor-vehicle which with the aid of aGPS (Global Positioning System) receiver, furthermore the ABS wheelsensors 17 and possibly of a compass, determines the current vehicleposition in the context of the digitally stored map, and from this,determines guidance information for guiding the motor-vehicle driver;

a display unit 25 which is used, first of all, for reproducingvehicle-specific information such as the instantaneous travel speed,mileage, engine speed, fuel-tank level and similar information, as wellas information such as the currently received broadcast transmittingfrequency or the received radio program set on broadcast receiver 22,the currently selected compact disk in CD changer 24 or the currentplay-back title of a specific compact disk, functions of the GSMtelephone, and possibly for the display of guidance information ofnavigation unit 28.

Finally, third computer 30 is used for processing information relatingto the so-called body electronics. Further components 31 through 33connected to fourth bus 85 are, in detail:

a control 31 for the central locking system;

a control 32 for the electric sunroof of the vehicle which, for example,closes an open sunroof automatically when shutting off the engine; and

an interior and exterior mirror adjustment 33, as well as an electricalseat adjustment for adapting various functions and elements which are inneed of adjustment to the individual requirements of the respectivemotor-vehicle driver, provision being made in the present example forusing control 33 to automatically adjust the diverse functions andelements to the respective driver after his/her identification by themotor-vehicle computer arrangement.

In a first exemplary embodiment of the vehicle computer arrangementaccording to the present invention, described interface 90 is aso-called chip-card reader into which an information-bearing chip card,e.g. in the form of the Key Card known from Blaupunkt Autoradios, can beinserted. After the chip card has been inserted into chip-card reader90, second computer 20, to which chip-card reader 90 is connected in thepresent exemplary embodiment, reads information from the chip card and,in the example of the aforementioned Key Card, supplies it tobroadcast-receiver component 22 for identifying the user and possiblyfor releasing the broadcast receiver for use. In addition, theinformation stored on the chip card for identifying the user is routedto third computer 30 from whose memory user-specific information for theseat and mirror adjustment, which the identified user had set uponleaving the motor vehicle, is read out and routed to seat and mirroradjustment 33 for adjusting the seat and the mirrors.

However, it is equally possible that the user-specific information, suchas the seat and mirror adjustment, a favorite radio program or apersonal telephone-number list for the GSM telephone, is not stored inthe second and third computers, i.e. components 22 through 28 and 31through 33 connected to these computers, but rather that upon shuttingoff the vehicle, this information is written into a memory of the chipcard inserted into chip-card reader 90, and upon renewed start-up of thevehicle computer arrangement, is read out from the chip card.

In a further exemplary embodiment, the chip card inserted into chip-cardreader 90 is used not only to identify the user and possibly to storeuser-specific data, but is also used to update and/or supplementcomponents of the operating program of one of computers 10, 20, 30and/or other parts of the vehicle computer arrangement or of furthercomponents 12, 13, 14, 15, 16, 17, 22, 24, 25, 26, 28, 31, 32, 33connected to one of computers 10, 20, 30. To that end, in the vehiclecomputer arrangement according to the present invention, the secondcomputer, possibly after checking the authorization of the chip cardinserted into chip-card reader 90, reads out operating-programcomponents from the chip card and supplies them to the affected parts ofthe vehicle computer arrangement or to further components for updatingand/or supplementing their operating programs.

In the same way, it is also provided that, for example, for the purposeof error diagnosis in an authorized motor-vehicle service station,information of the vehicle computer arrangement is read out from saidvehicle computer arrangement with the aid of interface 90 and is furtherprocessed. In the present exemplary embodiment, the information read outfrom the vehicle computer arrangement via the chip-card reader, whichhere is also simultaneously designed as a chip-card write device, iswritten into a memory of the chip card inserted into chip-card reader90.

The present exemplary embodiment also provides, for example, for thelast seat and mirror setting, as well as the radio program last listenedto and a personal telephone book of the user of the motor-vehiclearrangement to be written into the memory of the chip card, insertedinto chip-card reader 90, at the time of, or shortly prior to, leavingthe vehicle. This process is initiated, for instance, by switching offthe ignition of the motor vehicle.

In a further exemplary embodiment of the vehicle computer arrangementaccording to the present invention, interface 90 is in the form of acompact disk reading unit, so that by evaluating data stored on acompact disk inserted into compact disk reading unit 90, the operatingprogram of the vehicle computer arrangement, parts of the vehiclecomputer arrangement or further components 12 through 33 connected toone of computers 10, 20, 30, can be partially or completely exchanged orupdated. The procedure for updating the operating programs by datastored on a CD-ROM inserted into the compact disk reading unit iscarried out in the same manner as is customary, for example, in today'spersonal computers.

In another exemplary embodiment of the vehicle computer arrangementaccording to the present invention, interface 90 is implemented in theform of a transceiver 26, particularly a GSM mobile telephone 26,connected as a further component to one of the at least two computers.In this case, after establishing a radio link between transceiver 26 andan external data supplier, data sent by the data supplier are receivedby transceiver 26 in order to change and/or update parts of theoperating program of the vehicle computer arrangement, parts of thevehicle computer arrangement or further components 12 through 31connected to one of the at least two computers. In this context, data isfirst transmitted from the data supplier to the transceiver, and fromthere to the vehicle computer arrangement, after a request by thevehicle computer arrangement. However, it is equally possible for a datatransmission from the data supplier to the vehicle computer arrangementto be initiated by the data supplier, e.g. by a motor-vehiclemanufacturer. For example, this is useful when, after delivering aspecific group of vehicle computer arrangements, the motor-vehiclemanufacturer has discovered errors in their operating programs, or atleast operating-program components in need of improvement, which can beimproved and/or updated by this measure. In the same way, however, it isalso possible to route information via the transceiver 26/data supplierradio link to the data supplier, in this case, for example, amotor-vehicle service station, thus easily enabling a remote diagnosisof the motor vehicle while it is in operation on the basis, forinstance, of the vehicle data ascertained by sensor groups 14 and 17. Inresponse to the appearance of malfunctions, for example, themotor-vehicle service station can then automatically send a warning viathe data supplier/transceiver 26 radio link to the vehicle computerarrangement, and therefore to the motor-vehicle driver, which informsthem about possible malfunctions of the motor vehicle or of themotor-vehicle computer arrangement, or an imminent service-station stop.

In a further exemplary embodiment of the present vehicle computerarrangement, interface 90 is realized through a radio receiver 22,particularly a broadcast receiver, connected as a further component toone of the computers of the vehicle computer arrangement, data beingreceived by the transceiver as radio signals for changing and/orupdating parts of the operating program of the vehicle computerarrangement, of parts of the computer vehicle arrangement or of furthercomponents 12 through 31 connected to one of the computers. Theinformation received by radio receiver 22 is, for example, digitallycoded traffic-announcement information, transmitted over a broadcasttransmitting frequency within the so-called Traffic Message Channel(TMC) of the Radio Data System (RDS), which, for instance, navigationunit 28 can take into account during route planning and thecorresponding guidance of the motor-vehicle driver.

In the case of the present vehicle computer arrangement, thearchitecture of computers 10, 20, 30 of the vehicle computer arrangementaccording to the present invention is advantageously in the form ofstandard personal computers, and furthermore, the information processingin computers 10, 20, 30, as well as the data exchange of computers 10,20, 30 among themselves and with further components 12 through 31connected to the computers is carried out by way of a standard operatingsystem. In addition to excellent availability of the components,particularly of the computers for the vehicle computer arrangement, theeffect of this is that a widespread and generally accepted standard isprovided for the operating programs of the vehicle computer arrangement,so that motor-vehicle manufacturers as well as suppliers can fall backupon a uniform operating system when producing further components 12through 33 as well as when creating the necessary operating programs forthe vehicle computer arrangement and/or further components 12 through 33connected to it.

Alternatively thereto, however, various computers of the vehiclecomputer arrangement can also be provided with other than a standardpersonal-computer architecture. In the present exemplary embodiment, inwhich computers 10, 20, 30 have a standard PC architecture, bus systems60, 70, 80, 85 shown in the FIGURE are bus systems of type 1394, knownfrom the PC sector, which is a broadband, serial bus system, customaryin the industry, that is preferably used in PC consumer devices formultimedia applications. Another bus system utilized is the USB(Universal Serial Bus), a standard likewise coming from the PC industryfor a serial bus system having a smaller bandwidth compared to the 1394.However, it is equally possible for at least one part of computers 10through 30 to be interconnected via a CAN bus or a related-bus knownfrom the motor-vehicle industry.

In the present exemplary embodiment of the vehicle computer arrangementaccording to the present invention, provision is now made for a firstmonitoring circuit 40, arranged between first computer 10 and secondcomputer 20, which checks whether a data exchange between the first andthe second computer is permitted for data processed or to be processedin the first or the second computer, and which blocks the data exchangein the event that it is not permitted for the monitored data. Acorresponding monitoring circuit 50 is also arranged between firstcomputer 10, i.e. further components 12-17 connected to first computer10, and third computer 30 for the body electronics. This is based on theconsideration that the information processed by the various computersmust satisfy different safety requirements, so that an uncontrolledaccess by one of computers 20 or 30 to the safety-critical informationprocessed by first computer 10 is effectively prevented.

Therefore, the information processed in first computer 10 relates tosafety-critical requirements such as engine management 12 andtransmission-shift control 13, as well as the ABS/TCS control or aseat-belt tightener and airbag control, thus all such information andfunctions whose malfunction or uncontrolled manipulation can haveconsequences adversely affecting the safety of the motor vehicle or ofthe motor-vehicle driver. Therefore, monitoring circuits 40 and 50 ofthe vehicle computer arrangement shown in FIG. 1 screen off thesafety-critical region (first computer 10, further components 12 through17 and second bus 70) of the vehicle computer arrangement according tothe present invention vis-à-vis the relatively open region includingsecond computer 20, third computer 30, further components 22 through 28and 31 through 33, as well as third bus 80 and fourth bus 85, fromexternal access via interface 90.

On the other hand, however, it is also necessary that a controlledcommunication be possible between safety-relevant region 100 andrelatively freely accessible region 200. Thus, for example, informationof the engine management or transmission-shift control and of sensorgroups 14 and 17, as well as, for instance, information of theseat-belt-tightener and airbag control 16 is transmitted fromsafety-critical region 100 to second computer 20 via first monitoringcircuit 40. An example for such information is, for instance, the sensorsignals from sensors 17 containing information that is necessary forseat-belt-tightener/airbag control 16 and indicates that the motorvehicle has or is about to collide with an obstruction. In the event ofan accident of the affected motor vehicle, in the present exemplaryembodiment, this information is routed via first computer 10, firstmonitoring circuit 40 and second computer 20 to transceiver 26, viawhich an emergency call is automatically initiated, for instance, at thenearest police station. In the same way, data, for example, ofengine-management and transmission-shift-control sensors 14, such as thegear just engaged, the prevailing coolant temperature or oil temperatureof the engine, the instantaneous fuel consumption or similar informationis supplied for display to display unit 25 connected to second computer20 via third bus 80.

For the application cases described, it is initially sufficient thatdescribed monitoring circuits 40 and 50 completely block a data exchangefrom the second or third computer to the first computer, and permit adata exchange from the first to the second or third computer for atleast a part of the information. This means that, in a first exemplaryembodiment of the vehicle computer arrangement according to the presentinvention, monitoring circuits 40, 50 can be selectively transmissiveunidirectionally. The demand for selective transmissivity of themonitoring circuits follows, for example, from the fact that the readoutof, for instance, engine-specific characteristics fields, such as aninjection-quantity or an ignition-point characteristics field, shouldnot be possible by an unauthorized user.

However, at this point to permit, for example, the motor-vehiclemanufacturer to rework, exchange or supplement the safety-criticaloperating programs processed in first computer 10, a further exemplaryembodiment provides that monitoring circuits 40 and 50 aredisconnectible by, for instance, the motor-vehicle manufacturer oranother authorized person or service station. In this manner,information can also be transmitted from interface 90 via secondcomputer 20 and first bus 60 to first computer 10, and likewise viathird computer 30 and second bus 70 to first computer 10. In thiscontext, monitoring devices 40 and 50 can be disconnected, as in thepresent case, by a separate control line connected to the monitoringcircuits, as well as, for example, by a software design approach, forexample, by a code word protection. In the last case, for instance, themonitoring circuits would only be transmissive for such data which ispreceded by a specific header having a predefined code word.

As already indicated, in the present exemplary embodiment, a firstprotected region 100 of the vehicle computer arrangement is provided forprocessing safety-critical and vehicle-specific data, preferably for thecontrol of functions and/or aggregates of the motor vehicle and/or foracquiring vehicle-specific information. In addition, a further region,including second computer 20, third bus 80 and further components 22through 28 connected to them, is provided preferably for processinginformation of multimedia applications, particularly data of a broadcastreceiver 22, further audio signal sources 24, a mobile telephone 26 anda navigation device 28. Finally, a third computer, likewise allocated tounprotected region 200, is provided for processing information of thebody electronics, namely of control units, in the form of furthercomponents connected to fourth bus 85, for central locking system 31,sunroof 32 and seat and mirror adjustment 33.

Consequently, a division of the operating programs for the vehiclecomputer arrangement is achieved, to the effect that a first part of theoperating programs, namely, the operating programs provided for firstprotected region 100, is only accessible for an authorized group ofpeople, particularly the motor-vehicle manufacturer, along the lines ofan update or a readout of the operating programs, while a secondunprotected or only partially protected region 200 is also accessiblefor supplier or service firms, or even the owner of the motor vehicle.

In this context, the operating programs are preferably divided accordingto the criterion of safety-critical and vehicle-proprietary,respectively, and of multimedia and FIS (Driver Information System)applications which are not or are to a limited extent safety-criticaland are not vehicle-proprietary. An example for the last-indicatedapplications would be, for instance, a scheduler, computer games, wordprocessing or possibly even an Internet access.

While in the present exemplary embodiment, it is suggested to divide theoperating programs or the vehicle computer arrangement into a firstsafety-critical region and a second region which is not safety-criticalor is safety-critical only to a limited extent, it is, however, alsopossible to divide the vehicle computer arrangement or the operatingprograms according to other criteria, for example, real-time criticalapplications and those which are not real-time critical.

Although in FIG. 1, first and second monitoring circuits 40 and 50 areshown as separate circuits, in the present exemplary embodiment they arepreferably integrated into first computer 10 and third computer 30,respectively, and are implemented in them in the form of software.

What is claimed is:
 1. A vehicle computer arrangement comprising: at least two computers; at least one data bus via which the at least two computers are interconnected; and a monitoring circuit situated between a first and a second of the at least two computers; wherein the monitoring circuit checks whether a data exchange between the first computer and the second computer is permitted for at least one of data processed and data to be processed in at least one of the first computer and the second computer, and the monitoring circuit blocks the data exchange in the event the data exchange is not permitted for the monitored data.
 2. The vehicle computer arrangement as recited in claim 1, wherein: more than two computers are interconnected via data buses in such a way that each of the more than two computers is connected to at least one other of the more than two computers; and monitoring circuits for checking and possibly blocking the data exchange between the interconnected computers are situated in at least one subset of the interconnections between the more than two computers.
 3. The vehicle computer arrangement as recited in claim 1, wherein the monitoring circuit is integrated into one of the at least two interconnected computers.
 4. The vehicle computer arrangement as recited in claim 1, wherein the monitoring circuit is disconnectible, so that after disconnecting the monitoring circuit, a data exchange is possible between the first and the second of the at least two computers for the data which are blocked by the monitoring circuit for the exchange between the first computer and the second computer.
 5. The vehicle computer arrangement as recited in claim 1, further comprising: at least one interface for communication of the vehicle computer arrangement with at least one external component; wherein at least one of the monitoring circuit and a further monitoring circuit is situated between the at least one interface and at least one of the at least two computers.
 6. The vehicle computer arrangement as recited in claim 5, wherein: the interface includes a compact disk reader unit; the compact disk reader unit evaluating data stored on a compact disk inserted in the compact disk reader unit; and the data used for at least one of completely exchanging, partially exchanging, and updating, at least one of: the operating program of the vehicle computer arrangement; a part of the vehicle computer arrangement; and a further vehicle component connected to one of the at least two computers.
 7. The vehicle computer arrangement as recited in claim 5, wherein: the interface is implemented by a transceiver connected as a further component to one of the at least two computers; and the transceiver is able to receive data sent by a data supplier after establishing a radio link between the transceiver and the data supplier for at least one of changing and updating at least one of: a part of the operating program of the vehicle computer arrangement; a part of the vehicle computer arrangement; and a further vehicle component connected to one of the at least two computers.
 8. The vehicle computer arrangement as recited in claim 5, wherein: the interface is implemented by a radio receiver connected as a further component to one of the at least two computers; and the radio receiver is able to receive data as radio signals for at least one of changing and updating at least one of: a part of the operating program of the vehicle computer arrangement; a part of the vehicle computer arrangement; and a further component connected to one of the at least two computers.
 9. The vehicle computer arrangement as recited in claim 5, wherein: the interface is implemented by a chip-card reader; and data from a chip card inserted into the chip-card reader is able to be evaluated for at least one of changing and updating at least one of: a part of the operating program of the vehicle computer arrangement; a part of the vehicle computer arrangement; and a further component connected to one of the at least two computers.
 10. The vehicle computer arrangement as recited in claim 1, wherein at least one first computer of the at least two computers is provided for at least one of: processing vehicle-specific data; controlling at least one of functions and vehicle units; and acquiring vehicle-specific information.
 11. The vehicle computer arrangement as recited in claim 1, wherein at least one first computer of the at least two computers is: provided for processing vehicle-specific data; and connected to further components, including at least one of: control units for controlling functions and vehicle units; sensing devices for acquiring vehicle-specific information; and display instruments for displaying operating data of the vehicle.
 12. The vehicle computer arrangement as recited in claim 1, wherein at least one second computer of the at least two computers is provided for processing data of multimedia applications, including at least one of: data of a broadcast receiver; a further audio signal source; a mobile telephone; and a navigation device.
 13. The vehicle computer arrangement as recited in claim 1, wherein: at least one of the at least two computers is a personal computer; and at least one subset of the at least two computers communicates at least among themselves and with at least one of a further vehicle component with the aid of an operating system provided for a personal computer.
 14. The vehicle computer arrangement as recited in claim 1, wherein: the monitoring circuit blocks all data exchanges from the second computer to the first computer.
 15. The vehicle computer arrangement as recited in claim 14, wherein: the monitoring circuit allows an exchange of at least a portion of data from the first computer to the second computer. 